Alpha. Not production-ready. Breaking changes will occur. Features may be incomplete or only partially functional.

hibou

Eyes on what you ship.

A next-gen, self-hosted security intelligence platform for your whole SDLC: dependencies, code, pull requests, releases, and deployed clients.

VS Code & forks JetBrains Artifactory Alpha GitHub / GitLab / Forgejo/Gitea CI MCP / API All integrations ↓
Self-host Hibou See how it works ↓
Open standards, connected

SBOM / CycloneDX / SPDX

VEX / OpenVEX / CSAF

SARIF / 2.1.0

Across the SDLC

A scan is a snapshot.
Your software has a history.

Separate reports tell you what a scanner found. Hibou gives those results shared context: which repository, which commit, what changed, and which releases and clients are affected.

Self-hosted walkthrough: organization, triage, dependencies, coverage, and releases.
Native dependency discovery

No SBOM step?
Start with the source.

Discover dependencies from source, artifacts, and images. No SBOM required.

Scan locally; send package identifiers, not source or binaries, for advisory matching.

Inspect source, a past version, or an image 
$ hibou deps scan
$ hibou deps scan --git-ref v1.2.3
$ hibou deps scan --image registry.example/app:1.2.3
Beyond the scan report

Decisions backed by evidence.

Check before installing

Check lockfile packages against malware and release-cooldown policy before installation.

Missing scan ≠ fixed finding

Skipped or incomplete scans don't silently mark open findings as fixed.

Match advisories offline

Use an exported advisory database when your environment cannot reach the server.

Verify the deliverable

Compare SBOMs with artifacts and verify supported public-key-signed attestations.

Planned

Deterministic fix PRs

Rule-based upgrades for new dependency vulnerabilities on maintained release branches, verified before review.

The whole lifecycle

Your SDLC, connected.

Scan in CI, review pull requests, carry triage decisions forward, and track release impact for deployed clients.

01 / Collect

Run supported bundled scanners, or upload SBOMs, SARIF, secret findings, coverage, and test results from your CI jobs.

02 / Connect

Attach results to repository snapshots. Combine advisory aliases and keep scanner provenance, dependency versions, and scan history.

03 / Act

Prioritize findings, gate pull requests, and track affected releases and clients.

Investigate / Triage

Find what deserves attention.
Keep the reason.

A severity label is a starting point, not a decision. Filter findings by type, source, triage state, and known exploitation. Use CVSS and EPSS alongside affected-package and remediation details.

  • Combine filters with AND, OR, and grouped queries.
  • Use reachability analysis to assess vulnerable code paths.
  • Record decisions with VEX instead of repeating the same investigation after every scan.
Findings from the sample repository, with scores and source provenance alongside triage controls.
Inventory / Change review

Know what changed.
Not just what exists.

Discover dependencies directly from supported repository files, inspect a delivered artifact, or import a CycloneDX or SPDX SBOM. Keep each component's source of evidence visible. Compare snapshots as dependencies are added, upgraded, or removed; unknown versions and licenses stay explicit.

Review new and resolved findings alongside dependency and coverage deltas before a change lands. Keep the baseline visible rather than treating every scan as a new inbox.

Hibou's own dependency inventory, built from uploaded SBOMs rather than a mock dashboard.

Quality gates are advisory by default. Choose thresholds by branch pattern and opt into blocking when your team is ready. A triage decision can update a pull request check without rerunning CI.

Releases / Impact

A finding matters
where the software runs.

Follow risk beyond the default branch. Release history connects vulnerability counts to versions and client deployments, so you can investigate which shipped versions are affected.

Keep release, deployment, and rollback context alongside the repository history your team already uses.

Release history from the self-hosted Hibou instance, with version-specific risk and client associations.
Connected to your toolchain

Security context, where you work.

From your editor to your registry, one connected security workflow.

Code hosting
GitHub GitLab Forgejo Gitea

Connect repositories and bring quality checks back to pull requests.

Continuous integration
ActionsCLI / REST API

CI integration for GitHub, GitLab, and Forgejo/Gitea.

Package registries
ArtifactoryExperimental

Open-source package curation: apply malware blocks and release cooldowns at the registry, before developer or CI downloads.

Scanning & report imports
Bundled scanners / SARIF / SBOM / Coverage

Scan with Hibou, import external results, or combine both.

Vulnerability intelligence
OSV NVD GitHub Advisory Trivy OSS Index CVE List V5

Advisories and CVE records, with original source provenance.

Known exploitation
CISA KEV (US) ENISA EUVD (EU)

Prioritize vulnerabilities with observed exploitation, not severity alone.

Package health
deps.dev GOSSIP

Release cooldowns, deprecation, low usage, and suggested versions.

AI assistants & automation
MCP / CLI / REST API

Give compatible assistants and automation your instance's security context.

Team notifications
Slack Teams Discord Email / Webhooks

Send the events that matter to the channels your team uses.

Your infrastructure / Your data

Self-hosted, not a hosted service.

Hibou runs on infrastructure you control. The API and web UI ship together; your reports, findings, and triage history stay in your instance.

One binary. One database.
A Go backend with an embedded web UI, backed by PostgreSQL. Deploy a container or use the included Helm chart.
Shared instance, separate organizations.
Organizations, teams, and roles keep repository access scoped. Audit history records security decisions.
Automation without a separate console.
Use the REST API, CLI, built-in MCP server, and repository configuration to fit Hibou into existing workflows.
Open source, AGPL-3.0.
Inspect the implementation, run your own instance, and contribute changes. No hosted SaaS offering is available.
Container deployment →Cluster deployment →

Alpha. Not production-ready. Breaking changes will occur. A solo, spare-time project built with LLM assistance.

Try it before deploying

Explore with sample data.

The local development setup lets you explore repositories, findings, coverage, and pull requests before connecting your own pipeline. You need a container runtime, Git, Make, Go, and Node.js; the development container includes the toolchain.

Local development / shell
$ git clone https://github.com/hibouhq/hibou
$ cd hibou
$ cp .env.example .env
$ go mod download
$ npm --prefix site install
$ make dev-local

Once the database is ready, run make seed in a second terminal. Open localhost:3000 and select Dev Login. Keep this development instance private. Use configured authentication for a deployed instance.

Setup prerequisites and configuration →

Open source. On your terms.

AGPL-3.0 and in alpha. Explore the code, report an issue, or help shape what comes next.

Browse the source ↗
Hibou / Product view